{"id":"CVE-2021-48019","aliases":["EUVD-2021-34889","GHSA-375m-5fvv-xq23","GHSA-q48v-45cg-432r"],"status":"published","title":"Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies","description":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00248,"percentile":0.16145,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-805"],"published":"2021-04-19T15:11:54Z","modified":"2026-10-29T02:46:41Z","fixes":[{"ecosystem":"PyPI","package":"vyper","fixed_in":["0.2.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"vyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9"}]}]},{"source":"osv","ecosystem":"PyPI","package":"vyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9"}]}],"versions":["0.1.0b1","0.1.0b10","0.1.0b11","0.1.0b12","0.1.0b13","0.1.0b14","0.1.0b15","0.1.0b16","0.1.0b17","0.1.0b2","0.1.0b3","0.1.0b4","0.1.0b5","0.1.0b6","0.1.0b7","0.1.0b8","0.1.0b9","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8"]}],"products":[{"vendor":"vyperlang","product":"vyper"}],"references":[{"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/vyperlang/vyper/pull/2281","tags":["web"]},{"url":"https://pypi.org/project/vyper/"},{"url":"https://github.com/advisories/GHSA-375m-5fvv-xq23"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48019"},{"url":"https://github.com/advisories/GHSA-q48v-45cg-432r"},{"url":"https://pypi.org/project/vyper","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-48019","title":"Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies","description":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.","status":"published","published":"2026-10-21T00:36:18.96Z","modified":"2026-10-27T21:35:59.282Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-805"],"updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-34889","description":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.","status":"published","published":"2026-10-21T00:36:18Z","modified":"2026-10-27T21:35:59Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:22.052945Z"}],"ghsa":[{"id":"GHSA-q48v-45cg-432r","title":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function...","description":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.","status":"published","published":"2026-10-21T03:32:11Z","modified":"2026-10-21T03:32:12Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-805"],"updated_at":"2026-11-02T15:14:08.480034Z"},{"id":"GHSA-375m-5fvv-xq23","title":"VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption","description":"## Background\n\n@tjayrush reported a data handling issue with certain Web3 libraries using Vyper-deploy forwarder proxy contracts using our Vyper's built-in `create_forwarder_to` function prior to our change to support EIP-1167 style forwarder proxies.\n\n### Impact\nIf you are an end user of a forwarder-style proxy deployed using Vyper's built-in `create_forwarder_to` function AND you have a function that returns \u003e4096 bytes AND you do no return data sanitation on the value returned, you could potentially see a data corruption issue.\n\nOtherwise, if you are handling the result of a return call AND you expect a specific `RETURNDATASIZE` that is less than 4096 (such as `SafeERC20.safeTransfer`) then the call will fail that check.\n\n### Patches\nThe issue was patched when we upgraded to EIP-1167 style forwarder proxies in #2281.\n\n### Workarounds\nIf you are making a call to a contract method that is expected to return \u003c= 4096 bytes, there is no issue as the ABI decoders in both Solidity and Vyper will truncate the data properly. Web3 libraries will also do this, unless you are doing `eth_call` or `eth_sendTransaction` directly.\n\nIf you are using a Solidity library that checks `RETURNDATASIZE` of an external call to a forwarder proxy deployed prior to this patch, it will fail on that assertion (such as `SafeERC20.safeTransfer`). The workaround is to always do a greater than or equal to check, rather than a strict equals to check.","status":"published","published":"2021-04-19T15:11:54Z","modified":"2023-01-09T05:04:27Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:10.502376Z"}],"nvd":[{"id":"CVE-2021-48019","description":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.","status":"published","published":"2026-10-21T01:17:19.13Z","modified":"2026-10-27T22:17:08.05Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-805"],"updated_at":"2026-11-02T14:07:09.005706Z"}],"osv":[{"id":"CVE-2021-48019","description":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.","status":"published","published":"2026-10-21T01:17:19.13Z","modified":"2026-10-29T02:46:41.610542701Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"GHSA-375m-5fvv-xq23","title":"VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption","description":"## Background\n\n@tjayrush reported a data handling issue with certain Web3 libraries using Vyper-deploy forwarder proxy contracts using our Vyper's built-in `create_forwarder_to` function prior to our change to support EIP-1167 style forwarder proxies.\n\n### Impact\nIf you are an end user of a forwarder-style proxy deployed using Vyper's built-in `create_forwarder_to` function AND you have a function that returns \u003e4096 bytes AND you do no return data sanitation on the value returned, you could potentially see a data corruption issue.\n\nOtherwise, if you are handling the result of a return call AND you expect a specific `RETURNDATASIZE` that is less than 4096 (such as `SafeERC20.safeTransfer`) then the call will fail that check.\n\n### Patches\nThe issue was patched when we upgraded to EIP-1167 style forwarder proxies in #2281.\n\n### Workarounds\nIf you are making a call to a contract method that is expected to return \u003c= 4096 bytes, there is no issue as the ABI decoders in both Solidity and Vyper will truncate the data properly. Web3 libraries will also do this, unless you are doing `eth_call` or `eth_sendTransaction` directly.\n\nIf you are using a Solidity library that checks `RETURNDATASIZE` of an external call to a forwarder proxy deployed prior to this patch, it will fail on that assertion (such as `SafeERC20.safeTransfer`). The workaround is to always do a greater than or equal to check, rather than a strict equals to check.","status":"published","published":"2021-04-19T15:11:54Z","modified":"2026-10-24T02:56:08.111958927Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}